GCC Code Coverage Report
Directory: ./ Exec Total Coverage
File: sbin/ipsecctl/pfkdump.c Lines: 0 293 0.0 %
Date: 2017-11-13 Branches: 0 144 0.0 %

Line Branch Exec Source
1
/*	$OpenBSD: pfkdump.c,v 1.46 2017/04/19 15:59:38 bluhm Exp $	*/
2
3
/*
4
 * Copyright (c) 2003 Markus Friedl.  All rights reserved.
5
 *
6
 * Redistribution and use in source and binary forms, with or without
7
 * modification, are permitted provided that the following conditions
8
 * are met:
9
 * 1. Redistributions of source code must retain the above copyright
10
 *    notice, this list of conditions and the following disclaimer.
11
 * 2. Redistributions in binary form must reproduce the above copyright
12
 *    notice, this list of conditions and the following disclaimer in the
13
 *    documentation and/or other materials provided with the distribution.
14
 *
15
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25
 */
26
27
#include <sys/socket.h>
28
#include <sys/time.h>
29
#include <sys/sysctl.h>
30
#include <net/pfkeyv2.h>
31
#include <netinet/ip_ipsp.h>
32
#include <netdb.h>
33
#include <string.h>
34
#include <unistd.h>
35
#include <stdlib.h>
36
#include <stdio.h>
37
#include <err.h>
38
#include <errno.h>
39
40
#include "ipsecctl.h"
41
#include "pfkey.h"
42
43
static void	print_proto(struct sadb_ext *, struct sadb_msg *);
44
static void	print_flow(struct sadb_ext *, struct sadb_msg *);
45
static void	print_supp(struct sadb_ext *, struct sadb_msg *);
46
static void	print_prop(struct sadb_ext *, struct sadb_msg *);
47
static void	print_sens(struct sadb_ext *, struct sadb_msg *);
48
static void	print_spir(struct sadb_ext *, struct sadb_msg *);
49
static void	print_policy(struct sadb_ext *, struct sadb_msg *);
50
static void	print_sa(struct sadb_ext *, struct sadb_msg *);
51
static void	print_addr(struct sadb_ext *, struct sadb_msg *);
52
static void	print_key(struct sadb_ext *, struct sadb_msg *);
53
static void	print_life(struct sadb_ext *, struct sadb_msg *);
54
static void	print_ident(struct sadb_ext *, struct sadb_msg *);
55
static void	print_udpenc(struct sadb_ext *, struct sadb_msg *);
56
static void	print_tag(struct sadb_ext *, struct sadb_msg *);
57
static void	print_tap(struct sadb_ext *, struct sadb_msg *);
58
static void	print_satype(struct sadb_ext *, struct sadb_msg *);
59
60
static struct idname *lookup(struct idname *, u_int32_t);
61
static char    *lookup_name(struct idname *, u_int32_t);
62
static void	print_ext(struct sadb_ext *, struct sadb_msg *);
63
64
void		pfkey_print_raw(u_int8_t *, ssize_t);
65
static char	*print_flags(uint32_t);
66
67
struct sadb_ext *extensions[SADB_EXT_MAX + 1];
68
69
struct idname {
70
	u_int32_t id;
71
	char *name;
72
	void (*func)(struct sadb_ext *, struct sadb_msg *);
73
};
74
75
struct idname ext_types[] = {
76
	{ SADB_EXT_RESERVED,		"reserved",		NULL },
77
	{ SADB_EXT_SA,			"sa",			print_sa },
78
	{ SADB_EXT_LIFETIME_CURRENT,	"lifetime_cur",		print_life },
79
	{ SADB_EXT_LIFETIME_HARD,	"lifetime_hard",	print_life },
80
	{ SADB_EXT_LIFETIME_SOFT,	"lifetime_soft",	print_life },
81
	{ SADB_EXT_ADDRESS_SRC,		"address_src",		print_addr },
82
	{ SADB_EXT_ADDRESS_DST,		"address_dst",		print_addr },
83
	{ SADB_EXT_ADDRESS_PROXY,	"address_proxy",	print_addr },
84
	{ SADB_EXT_KEY_AUTH,		"key_auth",		print_key },
85
	{ SADB_EXT_KEY_ENCRYPT,		"key_encrypt",		print_key },
86
	{ SADB_EXT_IDENTITY_SRC,	"identity_src",		print_ident },
87
	{ SADB_EXT_IDENTITY_DST,	"identity_dst",		print_ident },
88
	{ SADB_EXT_SENSITIVITY,		"sensitivity",		print_sens },
89
	{ SADB_EXT_PROPOSAL,		"proposal",		print_prop },
90
	{ SADB_EXT_SUPPORTED_AUTH,	"supported_auth",	print_supp },
91
	{ SADB_EXT_SUPPORTED_ENCRYPT,	"supported_encrypt",	print_supp },
92
	{ SADB_EXT_SPIRANGE,		"spirange",		print_spir },
93
	{ SADB_X_EXT_SRC_MASK,		"src_mask",		print_addr },
94
	{ SADB_X_EXT_DST_MASK,		"dst_mask",		print_addr },
95
	{ SADB_X_EXT_PROTOCOL,		"protocol",		print_proto },
96
	{ SADB_X_EXT_FLOW_TYPE,		"flow_type",		print_flow },
97
	{ SADB_X_EXT_SRC_FLOW,		"src_flow",		print_addr },
98
	{ SADB_X_EXT_DST_FLOW,		"dst_flow",		print_addr },
99
	{ SADB_X_EXT_SA2,		"sa2",			print_sa },
100
	{ SADB_X_EXT_DST2,		"dst2",			print_addr },
101
	{ SADB_X_EXT_POLICY,		"policy",		print_policy },
102
	{ SADB_X_EXT_SUPPORTED_COMP,	"supported_comp",	print_supp },
103
	{ SADB_X_EXT_UDPENCAP,		"udpencap",		print_udpenc },
104
	{ SADB_X_EXT_LIFETIME_LASTUSE,	"lifetime_lastuse",	print_life },
105
	{ SADB_X_EXT_TAG,		"tag",			print_tag },
106
	{ SADB_X_EXT_TAP,		"tap",			print_tap },
107
	{ SADB_X_EXT_SATYPE2,		"satype2",		print_satype },
108
	{ 0,				NULL,			NULL }
109
};
110
111
struct idname msg_types[] = {
112
	{ SADB_ACQUIRE,			"sadb_acquire",		NULL },
113
	{ SADB_ADD,			"sadb_add",		NULL },
114
	{ SADB_DELETE,			"sadb_delete",		NULL },
115
	{ SADB_DUMP,			"sadb_dump",		NULL },
116
	{ SADB_EXPIRE,			"sadb_expire",		NULL },
117
	{ SADB_FLUSH,			"sadb_flush",		NULL },
118
	{ SADB_GET,			"sadb_get",		NULL },
119
	{ SADB_GETSPI,			"sadb_getspi",		NULL },
120
	{ SADB_REGISTER,		"sadb_register",	NULL },
121
	{ SADB_UPDATE,			"sadb_update",		NULL },
122
	{ SADB_X_ADDFLOW,		"sadb_addflow",		NULL },
123
	{ SADB_X_ASKPOLICY,		"sadb_askpolicy",	NULL },
124
	{ SADB_X_DELFLOW,		"sadb_delflow",		NULL },
125
	{ SADB_X_GRPSPIS,		"sadb_grpspis",		NULL },
126
	{ SADB_X_PROMISC,		"sadb_promisc",		NULL },
127
	{ 0,				NULL,			NULL },
128
};
129
130
struct idname sa_types[] = {
131
	{ SADB_SATYPE_UNSPEC,		"unspec",		NULL },
132
	{ SADB_SATYPE_AH,		"ah",			NULL },
133
	{ SADB_SATYPE_ESP,		"esp",			NULL },
134
	{ SADB_SATYPE_RSVP,		"rsvp",			NULL },
135
	{ SADB_SATYPE_OSPFV2,		"ospfv2",		NULL },
136
	{ SADB_SATYPE_RIPV2,		"ripv2",		NULL },
137
	{ SADB_SATYPE_MIP,		"mip",			NULL },
138
	{ SADB_X_SATYPE_IPIP,		"ipip",			NULL },
139
	{ SADB_X_SATYPE_TCPSIGNATURE,	"tcpmd5",		NULL },
140
	{ SADB_X_SATYPE_IPCOMP,		"ipcomp",		NULL },
141
	{ 0,				NULL,			NULL }
142
};
143
144
struct idname auth_types[] = {
145
	{ SADB_AALG_NONE,		"none",			NULL },
146
	{ SADB_AALG_MD5HMAC,		"hmac-md5",		NULL },
147
	{ SADB_X_AALG_RIPEMD160HMAC,	"hmac-ripemd160",	NULL },
148
	{ SADB_AALG_SHA1HMAC,		"hmac-sha1",		NULL },
149
	{ SADB_X_AALG_SHA2_256,		"hmac-sha2-256",	NULL },
150
	{ SADB_X_AALG_SHA2_384,		"hmac-sha2-384",	NULL },
151
	{ SADB_X_AALG_SHA2_512,		"hmac-sha2-512",	NULL },
152
	{ SADB_X_AALG_AES128GMAC,	"gmac-aes-128",		NULL },
153
	{ SADB_X_AALG_AES192GMAC,	"gmac-aes-192",		NULL },
154
	{ SADB_X_AALG_AES256GMAC,	"gmac-aes-256",		NULL },
155
	{ SADB_X_AALG_CHACHA20POLY1305,	"chacha20-poly1305",	NULL },
156
	{ 0,				NULL,			NULL }
157
};
158
159
struct idname enc_types[] = {
160
	{ SADB_EALG_NONE,		"none",			NULL },
161
	{ SADB_EALG_3DESCBC,		"3des-cbc",		NULL },
162
	{ SADB_X_EALG_AES,		"aes",			NULL },
163
	{ SADB_X_EALG_AESCTR,		"aesctr",		NULL },
164
	{ SADB_X_EALG_AESGCM16,		"aes-gcm",		NULL },
165
	{ SADB_X_EALG_AESGMAC,		"aes-gmac",		NULL },
166
	{ SADB_X_EALG_BLF,		"blowfish",		NULL },
167
	{ SADB_X_EALG_CAST,		"cast128",		NULL },
168
	{ SADB_EALG_NULL,		"null",			NULL },
169
	{ SADB_X_EALG_CHACHA20POLY1305,	"chacha20-poly1305",	NULL },
170
	{ 0,				NULL,			NULL }
171
};
172
173
struct idname comp_types[] = {
174
	{ SADB_X_CALG_NONE,		"none",			NULL },
175
	{ SADB_X_CALG_OUI,		"oui",			NULL },
176
	{ SADB_X_CALG_DEFLATE,		"deflate",		NULL },
177
	{ SADB_X_CALG_LZS,		"lzs",			NULL },
178
	{ 0,				NULL,			NULL }
179
};
180
181
struct idname flag_types[] = {
182
	{ SADB_SAFLAGS_PFS,		"pfs",			NULL },
183
	{ SADB_X_SAFLAGS_TUNNEL,	"tunnel",		NULL },
184
	{ SADB_X_SAFLAGS_CHAINDEL,	"chaindel",		NULL },
185
	{ SADB_X_SAFLAGS_UDPENCAP,	"udpencap",		NULL },
186
	{ SADB_X_SAFLAGS_ESN,		"esn",			NULL },
187
	{ 0,				NULL,			NULL }
188
};
189
190
struct idname identity_types[] = {
191
	{ SADB_IDENTTYPE_RESERVED,	"reserved",		NULL },
192
	{ SADB_IDENTTYPE_PREFIX,	"prefix",		NULL },
193
	{ SADB_IDENTTYPE_FQDN,		"fqdn",			NULL },
194
	{ SADB_IDENTTYPE_USERFQDN,	"ufqdn",		NULL },
195
	{ 0,				NULL,			NULL }
196
};
197
198
struct idname flow_types[] = {
199
	{ SADB_X_FLOW_TYPE_USE,		"use",			NULL },
200
	{ SADB_X_FLOW_TYPE_ACQUIRE,	"acquire",		NULL },
201
	{ SADB_X_FLOW_TYPE_REQUIRE,	"require",		NULL },
202
	{ SADB_X_FLOW_TYPE_BYPASS,	"bypass",		NULL },
203
	{ SADB_X_FLOW_TYPE_DENY,	"deny",			NULL },
204
	{ SADB_X_FLOW_TYPE_DONTACQ,	"dontacq",		NULL },
205
	{ 0,				NULL,			NULL }
206
};
207
208
struct idname states[] = {
209
	{ SADB_SASTATE_LARVAL,		"larval",		NULL },
210
	{ SADB_SASTATE_MATURE,		"mature",		NULL },
211
	{ SADB_SASTATE_DYING,		"dying",		NULL },
212
	{ SADB_SASTATE_DEAD,		"dead",			NULL },
213
	{ 0,				NULL,			NULL }
214
};
215
216
static struct idname *
217
lookup(struct idname *tab, u_int32_t id)
218
{
219
	struct idname *entry;
220
221
	for (entry = tab; entry->name; entry++)
222
		if (entry->id == id)
223
			return (entry);
224
	return (NULL);
225
}
226
227
static char *
228
lookup_name(struct idname *tab, u_int32_t id)
229
{
230
	struct idname *entry;
231
232
	entry = lookup(tab, id);
233
	return (entry ? entry->name : "unknown");
234
}
235
236
static void
237
print_ext(struct sadb_ext *ext, struct sadb_msg *msg)
238
{
239
	struct idname *entry;
240
241
	if ((entry = lookup(ext_types, ext->sadb_ext_type)) == NULL) {
242
		printf("unknown ext: type %u len %u\n",
243
		    ext->sadb_ext_type, ext->sadb_ext_len);
244
		return;
245
	}
246
	printf("\t%s: ", entry->name);
247
	if (entry->func != NULL)
248
		(*entry->func)(ext, msg);
249
	else
250
		printf("type %u len %u",
251
		    ext->sadb_ext_type, ext->sadb_ext_len);
252
	printf("\n");
253
}
254
255
static char *
256
print_flags(uint32_t flags)
257
{
258
	static char fstr[80];
259
	struct idname *entry;
260
	size_t len;
261
	int i, comma = 0, n;
262
263
	len = snprintf(fstr, sizeof(fstr), "%#x<", flags);
264
	if (len >= sizeof(fstr))
265
		return (NULL);
266
	for (i = 0; i < 32; i++) {
267
		if ((flags & (1 << i)) == 0 ||
268
		    (entry = lookup(flag_types, 1 << i)) == NULL)
269
			continue;
270
		n = snprintf(fstr + len, sizeof(fstr) - len - 1,
271
		    comma ? ",%s" : "%s", entry->name);
272
		if ((size_t)n >= sizeof(fstr) - len - 1)
273
			return (NULL);
274
		len += n;
275
		comma = 1;
276
	}
277
	strlcat(fstr, ">", sizeof(fstr));
278
279
	return (fstr);
280
}
281
282
static void
283
print_sa(struct sadb_ext *ext, struct sadb_msg *msg)
284
{
285
	struct sadb_sa *sa = (struct sadb_sa *)ext;
286
287
	if (msg->sadb_msg_satype == SADB_X_SATYPE_IPCOMP)
288
		printf("cpi 0x%8.8x comp %s\n",
289
		    ntohl(sa->sadb_sa_spi),
290
		    lookup_name(comp_types, sa->sadb_sa_encrypt));
291
	else
292
		printf("spi 0x%8.8x auth %s enc %s\n",
293
		    ntohl(sa->sadb_sa_spi),
294
		    lookup_name(auth_types, sa->sadb_sa_auth),
295
		    lookup_name(enc_types, sa->sadb_sa_encrypt));
296
	printf("\t\tstate %s replay %u flags %s",
297
	    lookup_name(states, sa->sadb_sa_state),
298
	    sa->sadb_sa_replay, print_flags(sa->sadb_sa_flags));
299
}
300
301
/* ARGSUSED1 */
302
static void
303
print_addr(struct sadb_ext *ext, struct sadb_msg *msg)
304
{
305
	struct sadb_address *addr = (struct sadb_address *)ext;
306
	struct sockaddr *sa;
307
	struct sockaddr_in *sin4;
308
	struct sockaddr_in6 *sin6;
309
	char hbuf[NI_MAXHOST];
310
311
	sa = (struct sockaddr *)(addr + 1);
312
	if (sa->sa_family == 0)
313
		printf("<any>");
314
	else if (getnameinfo(sa, sa->sa_len, hbuf, sizeof(hbuf), NULL, 0,
315
	    NI_NUMERICHOST))
316
		printf("<could not get numeric hostname>");
317
	else
318
		printf("%s", hbuf);
319
	switch (sa->sa_family) {
320
	case AF_INET:
321
		sin4 = (struct sockaddr_in *)sa;
322
		if (sin4->sin_port)
323
			printf(" port %u", ntohs(sin4->sin_port));
324
		break;
325
	case AF_INET6:
326
		sin6 = (struct sockaddr_in6 *)sa;
327
		if (sin6->sin6_port)
328
			printf(" port %u", ntohs(sin6->sin6_port));
329
		break;
330
	}
331
}
332
333
/* ARGSUSED1 */
334
static void
335
print_key(struct sadb_ext *ext, struct sadb_msg *msg)
336
{
337
	struct sadb_key *key = (struct sadb_key *)ext;
338
	u_int8_t *data;
339
	int i;
340
341
	printf("bits %u: ", key->sadb_key_bits);
342
	data = (u_int8_t *)(key + 1);
343
	for (i = 0; i < key->sadb_key_bits / 8; i++) {
344
		printf("%2.2x", data[i]);
345
		data[i] = 0x00;		/* clear sensitive data */
346
	}
347
}
348
349
/* ARGSUSED1 */
350
static void
351
print_life(struct sadb_ext *ext, struct sadb_msg *msg)
352
{
353
	struct sadb_lifetime *life = (struct sadb_lifetime *)ext;
354
355
	printf("alloc %u bytes %llu add %llu first %llu",
356
	    life->sadb_lifetime_allocations,
357
	    life->sadb_lifetime_bytes,
358
	    life->sadb_lifetime_addtime,
359
	    life->sadb_lifetime_usetime);
360
}
361
362
static void
363
print_proto(struct sadb_ext *ext, struct sadb_msg *msg)
364
{
365
	struct sadb_protocol *proto = (struct sadb_protocol *)ext;
366
367
	/* overloaded */
368
	if (msg->sadb_msg_type == SADB_X_GRPSPIS)
369
		printf("satype %s flags %x",
370
		    lookup_name(sa_types, proto->sadb_protocol_proto),
371
		    proto->sadb_protocol_flags);
372
	else
373
		printf("proto %u flags %x",
374
		    proto->sadb_protocol_proto, proto->sadb_protocol_flags);
375
}
376
377
/* ARGSUSED1 */
378
static void
379
print_flow(struct sadb_ext *ext, struct sadb_msg *msg)
380
{
381
	struct sadb_protocol *proto = (struct sadb_protocol *)ext;
382
	char *dir = "unknown";
383
384
	switch (proto->sadb_protocol_direction) {
385
	case IPSP_DIRECTION_IN:
386
		dir = "in";
387
		break;
388
	case IPSP_DIRECTION_OUT:
389
		dir = "out";
390
		break;
391
	}
392
	printf("type %s direction %s",
393
	    lookup_name(flow_types, proto->sadb_protocol_proto), dir);
394
}
395
396
static void
397
print_tag(struct sadb_ext *ext, struct sadb_msg *msg)
398
{
399
	struct sadb_x_tag *stag = (struct sadb_x_tag *)ext;
400
	char *p;
401
402
	p = (char *)(stag + 1);
403
	printf("%s", p);
404
}
405
406
static void
407
print_tap(struct sadb_ext *ext, struct sadb_msg *msg)
408
{
409
	struct sadb_x_tap *stap = (struct sadb_x_tap *)ext;
410
411
	printf("enc%u", stap->sadb_x_tap_unit);
412
}
413
414
static void
415
print_satype(struct sadb_ext *ext, struct sadb_msg *msg)
416
{
417
	struct sadb_protocol *proto = (struct sadb_protocol *)ext;
418
419
	printf("type %s", lookup_name(sa_types, proto->sadb_protocol_proto));
420
}
421
422
static char *
423
alg_by_ext(u_int8_t ext_type, u_int8_t id)
424
{
425
	switch (ext_type) {
426
	case SADB_EXT_SUPPORTED_ENCRYPT:
427
		return lookup_name(enc_types, id);
428
	case SADB_EXT_SUPPORTED_AUTH:
429
		return lookup_name(auth_types, id);
430
	case SADB_X_EXT_SUPPORTED_COMP:
431
		return lookup_name(comp_types, id);
432
	default:
433
		return "unknown";
434
	}
435
}
436
437
static void
438
print_alg(struct sadb_alg *alg, u_int8_t ext_type)
439
{
440
	printf("\t\t%s iv %u min %u max %u",
441
	    alg_by_ext(ext_type, alg->sadb_alg_id), alg->sadb_alg_ivlen,
442
	    alg->sadb_alg_minbits, alg->sadb_alg_maxbits);
443
}
444
445
/* ARGSUSED1 */
446
static void
447
print_supp(struct sadb_ext *ext, struct sadb_msg *msg)
448
{
449
	struct sadb_supported *supported = (struct sadb_supported *)ext;
450
	struct sadb_alg *alg;
451
452
	printf("\n");
453
	for (alg = (struct sadb_alg *)(supported + 1);
454
	    (size_t)((u_int8_t *)alg - (u_int8_t *)ext) <
455
	    ext->sadb_ext_len * PFKEYV2_CHUNK;
456
	    alg++) {
457
		struct sadb_alg *next = alg + 1;
458
		print_alg(alg, ext->sadb_ext_type);
459
		if ((size_t)((u_int8_t *)next - (u_int8_t *)ext) <
460
		    ext->sadb_ext_len * PFKEYV2_CHUNK)
461
			printf("\n");
462
	}
463
}
464
465
/* ARGSUSED1 */
466
static void
467
print_comb(struct sadb_comb *comb, struct sadb_msg *msg)
468
{
469
	printf("\t\tauth %s min %u max %u\n"
470
	    "\t\tenc %s min %u max %u\n"
471
	    "\t\taddtime hard %llu soft %llu\n"
472
	    "\t\tusetime hard %llu soft %llu",
473
	    lookup_name(auth_types, comb->sadb_comb_auth),
474
	    comb->sadb_comb_auth_minbits,
475
	    comb->sadb_comb_auth_maxbits,
476
	    lookup_name(enc_types, comb->sadb_comb_encrypt),
477
	    comb->sadb_comb_encrypt_minbits,
478
	    comb->sadb_comb_encrypt_maxbits,
479
	    comb->sadb_comb_soft_addtime,
480
	    comb->sadb_comb_hard_addtime,
481
	    comb->sadb_comb_soft_usetime,
482
	    comb->sadb_comb_hard_usetime);
483
#if 0
484
	    comb->sadb_comb_flags,
485
	    comb->sadb_comb_reserved,
486
	    comb->sadb_comb_soft_allocations,
487
	    comb->sadb_comb_hard_allocations,
488
	    comb->sadb_comb_soft_bytes,
489
	    comb->sadb_comb_hard_bytes,
490
#endif
491
}
492
493
/* ARGSUSED1 */
494
static void
495
print_prop(struct sadb_ext *ext, struct sadb_msg *msg)
496
{
497
	struct sadb_prop *prop = (struct sadb_prop *)ext;
498
	struct sadb_comb *comb;
499
500
	printf("replay %u\n", prop->sadb_prop_replay);
501
	for (comb = (struct sadb_comb *)(prop + 1);
502
	    (size_t)((u_int8_t *)comb - (u_int8_t *)ext) <
503
	    ext->sadb_ext_len * PFKEYV2_CHUNK;
504
	    comb++)
505
		print_comb(comb, msg);
506
}
507
508
/* ARGSUSED1 */
509
static void
510
print_sens(struct sadb_ext *ext, struct sadb_msg *msg)
511
{
512
	struct sadb_sens *sens = (struct sadb_sens *)ext;
513
514
	printf("dpd %u sens_level %u integ_level %u",
515
	    sens->sadb_sens_dpd,
516
	    sens->sadb_sens_sens_level,
517
	    sens->sadb_sens_integ_level);
518
}
519
520
/* ARGSUSED1 */
521
static void
522
print_spir(struct sadb_ext *ext, struct sadb_msg *msg)
523
{
524
	struct sadb_spirange *spirange = (struct sadb_spirange *)ext;
525
526
	printf("min 0x%8.8x max 0x%8.8x",
527
	    spirange->sadb_spirange_min, spirange->sadb_spirange_max);
528
}
529
530
/* ARGSUSED1 */
531
static void
532
print_ident(struct sadb_ext *ext, struct sadb_msg *msg)
533
{
534
	struct sadb_ident *ident = (struct sadb_ident *)ext;
535
536
	printf("type %s id %llu: %s",
537
	    lookup_name(identity_types, ident->sadb_ident_type),
538
	    ident->sadb_ident_id, (char *)(ident + 1));
539
}
540
541
/* ARGSUSED1 */
542
static void
543
print_policy(struct sadb_ext *ext, struct sadb_msg *msg)
544
{
545
	struct sadb_x_policy *x_policy = (struct sadb_x_policy *)ext;
546
547
	printf("seq %u", x_policy->sadb_x_policy_seq);
548
}
549
550
/* ARGSUSED1 */
551
static void
552
print_udpenc(struct sadb_ext *ext, struct sadb_msg *msg)
553
{
554
	struct sadb_x_udpencap *x_udpencap = (struct sadb_x_udpencap *)ext;
555
556
	printf("udpencap port %u", ntohs(x_udpencap->sadb_x_udpencap_port));
557
}
558
559
static void
560
setup_extensions(struct sadb_msg *msg)
561
{
562
	struct sadb_ext *ext;
563
564
	bzero(extensions, sizeof(extensions));
565
	if (msg->sadb_msg_len == 0)
566
		return;
567
	for (ext = (struct sadb_ext *)(msg + 1);
568
	    (size_t)((u_int8_t *)ext - (u_int8_t *)msg) <
569
	    msg->sadb_msg_len * PFKEYV2_CHUNK && ext->sadb_ext_len > 0;
570
	    ext = (struct sadb_ext *)((u_int8_t *)ext +
571
	    ext->sadb_ext_len * PFKEYV2_CHUNK))
572
		extensions[ext->sadb_ext_type] = ext;
573
}
574
575
static void
576
parse_addr(struct sadb_ext *ext, struct ipsec_addr_wrap *ipa)
577
{
578
	struct sadb_address *addr = (struct sadb_address *)ext;
579
	struct sockaddr *sa;
580
581
	if (addr == NULL)
582
		return;
583
	sa = (struct sockaddr *)(addr + 1);
584
	switch (sa->sa_family) {
585
	case AF_INET:
586
		ipa->address.v4 = ((struct sockaddr_in *)sa)->sin_addr;
587
		set_ipmask(ipa, 32);
588
		break;
589
	case AF_INET6:
590
		ipa->address.v6 = ((struct sockaddr_in6 *)sa)->sin6_addr;
591
		set_ipmask(ipa, 128);
592
		break;
593
	}
594
	ipa->af = sa->sa_family;
595
	ipa->next = NULL;
596
	ipa->tail = ipa;
597
}
598
599
static void
600
parse_key(struct sadb_ext *ext, struct ipsec_key *ikey)
601
{
602
	struct sadb_key *key = (struct sadb_key *)ext;
603
	u_int8_t *data;
604
605
	if (key == NULL)
606
		return;
607
	data = (u_int8_t *)(key + 1);
608
	ikey->data = data;
609
	ikey->len = key->sadb_key_bits / 8;
610
}
611
612
static void
613
parse_satype(struct sadb_ext *ext, u_int8_t *satype)
614
{
615
	struct sadb_protocol *proto = (struct sadb_protocol *)ext;
616
617
	if (proto == NULL)
618
		return;
619
	switch (proto->sadb_protocol_proto) {
620
	case SADB_SATYPE_ESP:
621
		*satype = IPSEC_ESP;
622
		break;
623
	case SADB_SATYPE_AH:
624
		*satype = IPSEC_AH;
625
		break;
626
	case SADB_X_SATYPE_IPCOMP:
627
		*satype = IPSEC_IPCOMP;
628
		break;
629
	case SADB_X_SATYPE_IPIP:
630
		*satype = IPSEC_IPIP;
631
		break;
632
	default:
633
		return;
634
	}
635
}
636
637
u_int32_t
638
pfkey_get_spi(struct sadb_msg *msg)
639
{
640
	struct sadb_sa *sa;
641
642
	setup_extensions(msg);
643
	sa = (struct sadb_sa *)extensions[SADB_EXT_SA];
644
	return (ntohl(sa->sadb_sa_spi));
645
}
646
647
/* opposite of pfkey_sa() */
648
void
649
pfkey_print_sa(struct sadb_msg *msg, int opts)
650
{
651
	int i;
652
	struct ipsec_rule r;
653
	struct ipsec_key enckey, authkey;
654
	struct ipsec_transforms xfs;
655
	struct ipsec_addr_wrap src, dst, dst2;
656
	struct sadb_sa *sa, *sa2;
657
658
	setup_extensions(msg);
659
	sa = (struct sadb_sa *)extensions[SADB_EXT_SA];
660
	bzero(&r, sizeof r);
661
	r.type |= RULE_SA;
662
	r.tmode = (msg->sadb_msg_satype != SADB_X_SATYPE_TCPSIGNATURE) &&
663
	    (sa->sadb_sa_flags & SADB_X_SAFLAGS_TUNNEL) ?
664
	    IPSEC_TUNNEL : IPSEC_TRANSPORT;
665
	r.spi = ntohl(sa->sadb_sa_spi);
666
667
	switch (msg->sadb_msg_satype) {
668
	case SADB_SATYPE_AH:
669
		r.satype = IPSEC_AH;
670
		break;
671
	case SADB_SATYPE_ESP:
672
		r.satype = IPSEC_ESP;
673
		break;
674
	case SADB_X_SATYPE_IPCOMP:
675
		r.satype = IPSEC_IPCOMP;
676
		break;
677
	case SADB_X_SATYPE_TCPSIGNATURE:
678
		r.satype = IPSEC_TCPMD5;
679
		break;
680
	case SADB_X_SATYPE_IPIP:
681
		r.satype = IPSEC_IPIP;
682
		break;
683
	default:
684
		return;
685
	}
686
	bzero(&dst, sizeof dst);
687
	bzero(&src, sizeof src);
688
	parse_addr(extensions[SADB_EXT_ADDRESS_SRC], &src);
689
	parse_addr(extensions[SADB_EXT_ADDRESS_DST], &dst);
690
	r.src = &src;
691
	r.dst = &dst;
692
	if (r.satype == IPSEC_IPCOMP) {
693
		if (sa->sadb_sa_encrypt) {
694
			bzero(&xfs, sizeof xfs);
695
			r.xfs = &xfs;
696
			switch (sa->sadb_sa_encrypt) {
697
			case SADB_X_CALG_DEFLATE:
698
				xfs.compxf = &compxfs[COMPXF_DEFLATE];
699
				break;
700
			case SADB_X_CALG_LZS:
701
				xfs.compxf = &compxfs[COMPXF_LZS];
702
				break;
703
			}
704
		}
705
	} else if (r.satype == IPSEC_TCPMD5) {
706
		bzero(&authkey, sizeof authkey);
707
		parse_key(extensions[SADB_EXT_KEY_AUTH], &authkey);
708
		r.authkey = &authkey;
709
	} else if (sa->sadb_sa_encrypt || sa->sadb_sa_auth) {
710
		bzero(&xfs, sizeof xfs);
711
		r.xfs = &xfs;
712
		if (sa->sadb_sa_encrypt) {
713
			bzero(&enckey, sizeof enckey);
714
			parse_key(extensions[SADB_EXT_KEY_ENCRYPT], &enckey);
715
			r.enckey = &enckey;
716
717
			switch (sa->sadb_sa_encrypt) {
718
			case SADB_EALG_3DESCBC:
719
				xfs.encxf = &encxfs[ENCXF_3DES_CBC];
720
				break;
721
			case SADB_X_EALG_AES:
722
				switch (r.enckey->len) {
723
				case 192/8:
724
					xfs.encxf = &encxfs[ENCXF_AES_192];
725
					break;
726
				case 256/8:
727
					xfs.encxf = &encxfs[ENCXF_AES_256];
728
					break;
729
				default:
730
					xfs.encxf = &encxfs[ENCXF_AES];
731
					break;
732
				}
733
				break;
734
			case SADB_X_EALG_AESCTR:
735
				switch (r.enckey->len) {
736
				case 28:
737
					xfs.encxf = &encxfs[ENCXF_AES_192_CTR];
738
					break;
739
				case 36:
740
					xfs.encxf = &encxfs[ENCXF_AES_256_CTR];
741
					break;
742
				default:
743
					xfs.encxf = &encxfs[ENCXF_AESCTR];
744
					break;
745
				}
746
				break;
747
			case SADB_X_EALG_AESGCM16:
748
				switch (r.enckey->len) {
749
				case 28:
750
					xfs.encxf = &encxfs[ENCXF_AES_192_GCM];
751
					break;
752
				case 36:
753
					xfs.encxf = &encxfs[ENCXF_AES_256_GCM];
754
					break;
755
				default:
756
					xfs.encxf = &encxfs[ENCXF_AES_128_GCM];
757
					break;
758
				}
759
				break;
760
			case SADB_X_EALG_AESGMAC:
761
				switch (r.enckey->len) {
762
				case 28:
763
					xfs.encxf = &encxfs[ENCXF_AES_192_GMAC];
764
					break;
765
				case 36:
766
					xfs.encxf = &encxfs[ENCXF_AES_256_GMAC];
767
					break;
768
				default:
769
					xfs.encxf = &encxfs[ENCXF_AES_128_GMAC];
770
					break;
771
				}
772
				break;
773
			case SADB_X_EALG_BLF:
774
				xfs.encxf = &encxfs[ENCXF_BLOWFISH];
775
				break;
776
			case SADB_X_EALG_CAST:
777
				xfs.encxf = &encxfs[ENCXF_CAST128];
778
				break;
779
			case SADB_X_EALG_CHACHA20POLY1305:
780
				xfs.encxf = &encxfs[ENCXF_CHACHA20_POLY1305];
781
				break;
782
			case SADB_EALG_NULL:
783
				xfs.encxf = &encxfs[ENCXF_NULL];
784
				break;
785
			}
786
		}
787
		if (sa->sadb_sa_auth) {
788
			bzero(&authkey, sizeof authkey);
789
			parse_key(extensions[SADB_EXT_KEY_AUTH], &authkey);
790
			r.authkey = &authkey;
791
792
			switch (sa->sadb_sa_auth) {
793
			case SADB_AALG_MD5HMAC:
794
				xfs.authxf = &authxfs[AUTHXF_HMAC_MD5];
795
				break;
796
			case SADB_X_AALG_RIPEMD160HMAC:
797
				xfs.authxf = &authxfs[AUTHXF_HMAC_RIPEMD160];
798
				break;
799
			case SADB_AALG_SHA1HMAC:
800
				xfs.authxf = &authxfs[AUTHXF_HMAC_SHA1];
801
				break;
802
			case SADB_X_AALG_SHA2_256:
803
				xfs.authxf = &authxfs[AUTHXF_HMAC_SHA2_256];
804
				break;
805
			case SADB_X_AALG_SHA2_384:
806
				xfs.authxf = &authxfs[AUTHXF_HMAC_SHA2_384];
807
				break;
808
			case SADB_X_AALG_SHA2_512:
809
				xfs.authxf = &authxfs[AUTHXF_HMAC_SHA2_512];
810
				break;
811
			}
812
		}
813
	}
814
	if (!(opts & IPSECCTL_OPT_SHOWKEY)) {
815
		bzero(&enckey, sizeof enckey);
816
		bzero(&authkey, sizeof authkey);
817
		extensions[SADB_EXT_KEY_AUTH] = NULL;
818
		extensions[SADB_EXT_KEY_ENCRYPT] = NULL;
819
	}
820
	if (extensions[SADB_X_EXT_SA2]) {
821
		r.type |= RULE_BUNDLE;
822
		sa2 = (struct sadb_sa *)extensions[SADB_X_EXT_SA2];
823
		r.spi2 = ntohl(sa2->sadb_sa_spi);
824
		parse_addr(extensions[SADB_X_EXT_DST2], &dst2);
825
		r.dst2 = &dst2;
826
		parse_satype(extensions[SADB_X_EXT_SATYPE2], &r.proto2);
827
		r.proto = r.satype;
828
	}
829
	ipsecctl_print_rule(&r, opts);
830
831
	if (opts & IPSECCTL_OPT_VERBOSE) {
832
		for (i = 0; i <= SADB_EXT_MAX; i++)
833
			if (extensions[i])
834
				print_ext(extensions[i], msg);
835
	}
836
	fflush(stdout);
837
}
838
839
/* ARGSUSED1 */
840
void
841
pfkey_monitor_sa(struct sadb_msg *msg, int opts)
842
{
843
	int		 i;
844
845
	setup_extensions(msg);
846
847
	printf("%s: satype %s vers %u len %u seq %u pid %u\n",
848
	    lookup_name(msg_types, msg->sadb_msg_type),
849
	    lookup_name(sa_types, msg->sadb_msg_satype),
850
	    msg->sadb_msg_version, msg->sadb_msg_len,
851
	    msg->sadb_msg_seq,
852
	    msg->sadb_msg_pid);
853
	if (msg->sadb_msg_errno)
854
		printf("\terrno %u: %s\n", msg->sadb_msg_errno,
855
		    strerror(msg->sadb_msg_errno));
856
	for (i = 0; i <= SADB_EXT_MAX; i++)
857
		if (extensions[i])
858
			print_ext(extensions[i], msg);
859
	fflush(stdout);
860
}
861
862
void
863
pfkey_print_raw(u_int8_t *data, ssize_t len)
864
{
865
	int i;
866
	const u_int8_t *sp = (const u_int8_t *)data;
867
868
	printf("RAW PFKEYV2 MESSAGE:\n");
869
	for (i = 0; i < len; i++) {
870
		if ((i % 8 == 0) && (i != 0))
871
			printf("\n");
872
		printf("%02x ", *sp);
873
		sp++;
874
	}
875
	printf("\n");
876
}